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Figure I Intelligent Control System Functional Framework 


engine level control is responsible for satisfying thrust and 
mixture ratio demand, avoiding engine conditions having a 
detrimental impact on hardware durability, and accommodating 
engine component hard/soft faults. As shown In the figure, 
requirements flow down in the hierarchy and status 
information for decision making flows up. 

The real-time diagnostic system included in Figure I 
consists of sensor validation, model based failure detection, 
rule based failure detection, and the diagnostic expert system. 
These functions, described below, are all part of a real-time 
distributed architecture for diagnostics and are responsible for 
identifying and isolating any change/degradation in engine 
valves, sensors or components. The engine level coordinator 
makes alterations to the control using engine status 
information generated by the diagnostic system, and 
propulsion requirements provided by" the propulsion level 
control. The reconfigurable controller takes requests generated 
by the coordinator, makes the changes gradually thereby 
minimizing engine transients, and computes the valve 
positions to achieve the requested behavior from the rocket 
eiigine. All operations at the engine level must be performed 
In real-time, however high sampling requirements are necessary 
only for the direct control loop which is composed of sensor 
validation and reconfigurable control. Other operations such 
as decision making in the coordinator may take longer but 
must still be deterministic to achieve reliable operation. 

CONTROLS AND COORDINATION 

Control parameters for a liquid chemical rocket engine 
traditionally have been pressure and mixture ratio in the main 
combustion chamber-^. However, research which explored 
additional control parameters for closed loop control of a large 
scale reusable rocket (Space Shuttle Main Engine) resulted in 
a number of advanced control modes for the engine based on 
knowledge gained over years of test experience with that 
particular cycle 4 . In decreasing order of importance, the 
control modes are 1) mixture ratio regulation, 2) variable 
throttling, 3) accommodation of failed actuators 4) active 
control of high pressure turbine temperatures (fuel and 
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Figure 2 Coordination and Control in the Propulsion 
Hierarchy 

for fault tolerance,- and modes 4 and 5 are used for minimizing 
transients in the engine cycle whose presence have a negative 
impact on hardware durability and overall engine performance. 

Ideally, we would like to achieve independent closed loop 
control of each of the parameters outlined above to achieve 
acceptable performance while simultaneously avoiding 
conditions which shorten hardware life. However, limitations 
on the availability of valves for regulation of propellant flow 
on existing SSME hardware constrain the number of 
parameters for independent control to no more than five. 
Nemeth 4 has proposed a number of new valve locations some 
of which are presently under study by Musgrave 5 . A linear 
multivariable controls approach is a natural candidate for 
handling the multidimensional aspects of the problem 5 . 
However, mode switching is still required given the large 
number of control parameters if all parameters are to be 
regulated. For example, high pressure turbine discharge 
temperatures may be controlled at full power to avoid rediines 
along with mixture ratio and chamber pressure, while pump 
inlet pressures may replace the temperatures as controlled 
variables to achieve rapid throttling without pump cavitation. 

Controller reconfiguration is necessary to accommodate 
those failed valves which play an important role in closed 
loop operation of the engine. To handle this situation, a priori 
control design satisfies thrust and mixture ratio control 
requirements for the degraded engine with the faulty valve 
missing from the linear engine design model. Control 
blending (linear interpolation) is used to bring the new 
controller on-line and phase out the nominal engine controller. 
This method will be applied to all identifiable failures 
requiring control redesign to achieve fault tolerant engine 
operation. 

Coordination occurs at the engine and propulsion levels in 
the hierarchy of Figure 2. The engine level coordinator may 
change the setpoints of the currently controlled variables to 
meet performance constraints, avoid detrimental operating 
conditions, change the controlled variables (ie. mode 
switching), or select an alternate control structure to 
accommodate a failed or degraded component in the engine 
system as summarized in Figure 3. Moreover, degradations or 

















diagnostic system. The engine level coordinator is responsible 
for meeting thrust and mixture ratio requirements set by the 
propulsion level to the extent possible while avoiding an 
engine shutdown condition. Exact thrust and mixture ratio 
demands can be met if required by the propulsion level 
coordinator to avoid loss of mission by limiting the controlled 
variables to chamber pressure and mixture ratio. Information 
about the health of the engine and the necessary performance 
paiameters are supplied to the propulsion coordinator to aid 
decision making at that level. 

The propulsion level coordinator is responsible for 
managing propellant utilization through mixture ratio 
commands given to each engine subsystem, setting the thrust 
levels for each engine to meet mission requirements, and 
actively controlling propellant tank pressure via liquid 
hydrogen and liquid oxygen bleed flow in the engine 
subsystems. The propulsion level coordinator also has the 
capability to shutdown any engine in the system or force an 
engine to operate at levels known by the engine level 
coordinator to result in an engine shutdown if required for 
mission success. An example demonstrating propulsion level 
coordination/control has been demonstrated on a simplified 
propulsion system 6 . 


DIAGNOSTICS 


A hiei ni chicnl, decentralized diagnostic system was 
P r °Posed for the Real-Time Diagnostic System component of 
the ICS framework 7 . Figure 4 shows the proposed diagnostic 
system having three "layers" of information processing. These 
are condition monitoring, fault mode detection, and expert 
system diagnosis. The condition monitoring layer is the first 
level signal processing. Here, important features to be used in 
the diagnostic system are extracted from the incoming data 
stream and processed. 'The processed data are then used by the 
higher level. fault mode detection layer to do a preliminary 
diagnosis of potential faults at the component level. Because 
or the closely coupled nature of rocket engine propulsion 
system components, it is expected that a given fault condition 
may trigger more than one fault mode detector. For example, a 
surge in the pump outlet temperature measurement on the low 
pressure fuel turbopump (LPFTP) may trigger an alarm on the 
sensor failure detector as well as the LPFTP seal leakage fault 
mode detector. Expert knowledge is needed to resolve the 



Figure 4 Distributed Diagnostic Architecture 


conflicting reports from the various failure mode detectors. 
This is the function of the diagnostic expert layer. Here, the 
heuristic nature of this decision process makes it desirable to 
use an expert system approach. 

Implementation of the real-time diagnostic system described 
above requires a wide spectrum of information processing 
capability. Generally, in the condition monitoring layer, fast 
data processing is often needed for feature extraction and 
signal conditioning. This is usually followed by some 
detection logic to determine the selected faults on the 
component level. Three different techniques are used to attack 
different fault detection problems 8 . Figure 5 shows the current 
elements of the distributed diagnostic system. The first 
technique employed is the neural network application for 
real-time sensor validation which includes failure detection, 
isolation and accommodation 9 . The second approach is the 
model-based fault diagnosis system using on-line parameter 
identification techniques where input data is processed to 
estimate important parameters for the predefined fault detection 
logic 10. Besides these model based diagnostic schemes, there 
are still many failure modes which need to be diagnosed by 
heuristic expert knowledge. The heuristic exj)ert knowledge is 
implemented using a real time expert system tool called G2™. 
Finally, the distributed diagnostic system requires another 
level of intelligence to oversee the fault inode reports 
generated by component fault detectors. The decision making 
at this level can be best done using a rule-based expert system. 
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Figure 5 Intelligent Control Diagnostic System 

NEURAL NETWORK CASED SENSOR VALIDATION - 
The goals of neural network based sensor validation are to I) 
identity the failed sensor where its output is inconsistent with 
other measurements, and 2) generate an estimated value for the 
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failed sensor. In order to apply neural networks to sensor 
validation, a group of analytically redundant sensors is 
selected. Figure 6 shows the structure of the autoassociative 
neural network For sensor validation which is trained to 
generate an on-line estimate for each given sensor. In an 
autoassociative neural network the first half of the neural 
network compresses the data into a minimum order 
representation and the second half of the neural network 
recovers the encoded information. Because of the information 
compression and recovery, the neural network is relatively 
insensitive to the errors generated by a single sensor fault. By 
comparing the incoming measurements with corresponding 
estimates, a sensor failure can be identified if a sensor reading 
departs from its estimated value while other sensor readings 
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Figure 6 Autoassociative Nenial Network for Sensor 
Validation 

slay close to their estimates. Failed sensor isolation is done 
by replacing the failed sensor input (to the neural network 
estimator) with its estimated value. The neural network then 
can be used to detect consecutive sensor failures. 

MODEL BASED FAULT DETECTION - Model based 
fault detection uses a model of nominal operation to detect any 
abnormal operating behavior that can be classified into a 
specified structure. The nominal model used here is a 
piecewise linear model of the Space Shuttle Main Engine 1 ’ 
developed from nonlinear simulation data. Figure 7 shows the 
functional layout of the model based fault detection scheme. 
Fault modes are classified into actuator faults, sensor failures, 
and system performance degradations. Each of these three 
different fault modes is represented by a model with a different 
structure. Three hypothesis modules (fault model structure) 
are used to estimate fault parameters of these fault models 
using an on-line parameter estimation technique. The residuals 
of each hypothesis module associated with the estimation 
process are used to select the correct fault hypothesis, and the 
estimated fault parameters are then used to describe the kind of 
fault within the selected class. This detection algorithm has 
been shown to be very effective for the detection and 
diagnosis of actuator faults. 

RULE BASED FAULT DETECTION - Rule based fault 
detection is the diagnosis of fault modes using heuristic expert 
knowledge. Because of the real-time requirement of the 
Intelligent Control System, the expert system was developed 
using the real-time expert system shell called G2™. A rule 
based diagnostic system for High Pressure Oxidizer 
Turbopump failure modes has been implemented in G2TM 12. 
Also, expert rules are also used to resolve the conflict reports 
from the sensor failure detection module, the model based fault 
detection module, and the component fault detection modules. 
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Figure 7 Model-Based Fault Detection and Diagnostic 
System 

SIMULATION TEST BED 

As noted earlier, a key miiestone in the development of an 
ICS for reusable rocket engines is successful integration of 
real time diagnostics with multivariable controls. Successful 
integration can be performed in a simulation envirbnment at a 
much lower cost without the additional restrictions of limited 
sensing and other operational constraints associated with a 
hardware test facility. Moreover, failures or degradations in 
hardware are expensive to perform and difficult to control 
making simulation studies a logical first step. Hot fire data 
can often be used in the development of condition monitoring 
algorithms. However, the ICS has the additional requirement 
of failure mode accommodation which cannot be studied using 
historical data. In addition, study of the behavior of the 
condition monitoring algorithms with closed loop 
multivariable control is an important step in the fine timing of 
the diagnostic expert system which is best performed using 
repeated simulation studies. 

Real time implementation of the various technologies under 
development for the project is an important aspect of the ICS 
program. For example, implementation of expert systems 
running on conventional hardware remains an open question 
for sampling rates required for the rocket engine (50 ms - 0.5 
sec.) although off-the-shelf products exist for sampling rates 
over I sec. Emerging technologies such as neural nets are 
being evaluated for hardware implementation of various tasks 
including sensor fault detection, isolation and accommodation. 
Finally, state-of-the-art software tools are being used 
extensively to develop and generate real time code for 
implementation of the engine level coordinator, the 
recon figurable control and the propulsion level control. In 
short, a variety of implementation techniques are being 
considered many of which require further development before 
application to a rocket engine becomes feasible. 

The simulation test bed facility developed at Lewis for 
proof-of-concept is shown schematically in Figure 8. The 
facility consists primarily of four major computers as follows: 
CIM Unit. Applied Dynamics International AD100. Vaxstation 
3500. and TI Explorer I! LX. The CIM Unit is a special 
purpose Control. Interface and Monitoring computet developed 
in-house for performing hardware in-the-ioop evaluation of 
control designs. The AD 100 is a special purpose real time 
simulation computer complete with multichannel analog I/O 
for engine simulation. The Vaxstation 3500 runs a real time 
rule based expert system called G2™ developed by 
GENSYM. Finally, a TI Explorer, a special purpose lisp 
machine, provides a flexible object oriented environment for 
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Figure 8 Intelligent Control System Simulation Test Bed 

development/implementation of a monitoring interface for the 
ICS. A personal computer with an ANZA^M board 
implements the neural networks used for evaluating the 
algorithms and behavior of a “hardware" network in a closed 
loop system. 

Figure 8 also displays the real time potential of the test 
bed system. The CJM Unit, AD 100, and PC are 
interconnected with analog links providing real time transfer 
of data. A direct digital link provides shared memory 
communication between G2™ and the CIM unit. The user 
interface does not perform critical functions and does not 
degrade system performance through the ethernet link. 
Presently, all hardware is capable of performing its designated 
tasks in real time with the exception of G2™ on the 
Vaxstation which has an update interval of l sec. Hence, real 
time operation of the simulation test bed could be achieved if 
the speed of the diagnostic expert system could be increased 
by at least a factor of 10. Work is ongoing toward meeting 
this objective for a real time ICS. 

CONCLUSIONS 

The current research program at the Lewis Research Center 
in Intelligent Control Systems for reusable rocket engines was 
presented. A functional organization of an intelligent control 
system, called a framework, was developed for a baseline 
engine. The framework described the integration and 
cooidination of reconfigurable control with real time engine 
fault diagnostics. The control and coordination functions of 
this framework were described as well as the real time 
diagnostics. Important characteristics of the diagnostic system 
included a decentralized approach to condition monitoring and 
fault detection. This allows a parallel implementation to 
achieve real time decision making. Finally, the evaluation of 
this technology is being accomplished on a distributed 
simulation test bed. This test bed not only allows real time 
evaluation of the ICS functions but it also emulates one 
possible bread-board implementation. 
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